Discuss August 2006

discuss@lists.centos.org

269 participants
332 discussions

Problems with x86_64 kickstart
by Tracy R Reed 13 Aug '06

13 Aug '06

I have successfully set up a very nice kickstart install with the i386 version of CentOS 4.3 and it works great. I am using a custom kickstart script and the kernel and initrd from disc1/images. But when I try to duplicate this for a 64 bit setup (changing paths in my tftp server, ks.cfg, etc to point to the 64 bit stuff) it successfully tftp's everything just as it should (tethereal output follows): 0.000000 192.168.0.201 -> 192.168.0.7 TFTP Read Request, File: linux-install/pxelinux.0, Transfer type: octet 0.002503 192.168.0.201 -> 192.168.0.7 TFTP Read Request, File: linux-install/pxelinux.0, Transfer type: octet 0.039763 192.168.0.201 -> 192.168.0.7 TFTP Read Request, File: linux-install/pxelinux.cfg/01-00-0c-29-14-3a-c5, Transfer type: octet 0.045674 192.168.0.201 -> 192.168.0.7 TFTP Read Request, File: linux-install/msgs/boot.msg, Transfer type: octet 0.522788 192.168.0.201 -> 192.168.0.7 TFTP Read Request, File: linux-install/CentOS4.3/x86_64/vmlinuz, Transfer type: octet 2.487047 192.168.0.201 -> 192.168.0.7 TFTP Read Request, File: linux-install/CentOS4.3/x86_64/initrd.img, Transfer type: octet But then it never tries to get the ks.cfg. I am booting it with: label centos kernel CentOS4.3/x86_64/vmlinuz append initrd=CentOS4.3/x86_64/initrd.img ramdisk_size=7000 ksdevice=eth0 ks=http://192.168.0.7/network-install/ks.cfg.x86_64 (that last line should be all one line) in the /tftpboot/linux-install/pxelinux.cfg/01-00-0c-29-14-3a-c5 config file which it tftp's so it should know that it needs to get the ks.cfg.x86_64 file. I have this same setup working for i386 and it seems to work fine. I would guess there might be some difference in the initrd's but for some reason /linuxrc is a symlink to sbin/init which is a binary executable instead of a shell script. Anyone know why it isn't a shell? And why would my x86_64 kickstart be behaving different from my i386? Any help is very much appreciated! -- Tracy R Reed http://ultraviolet.org A: Because we read from top to bottom, left to right Q: Why should I start my reply below the quoted text

3 6

cpuspeed causing hangs on warm boots
by Dan Halbert 12 Aug '06

12 Aug '06

We are using CentOS-4.3 (x86_64) with Opteron servers, and noticed a problem with cpuspeed: If we reboot by doing "# reboot" or similar from a shell, the boot will hang not long after cpuspeed starts. The machine freezes: ctrl-alt-del doesn't work, and only pressing the reset button or a power cycle will restart the machine. If we reboot from power-up or by pressing the reset button, there is no hang, and the boot proceeds normally. Another strange thing is that only some boxes have this problem. Others, seemingly identical, reboot just fine. We've compared the BIOS settings, the CPU steppings, etc., and they seem to be identical. It's very odd. Maybe we're missing a BIOS setting, but we couldn't find a difference. We've fixed this just by turning off the cpuspeed service. It took some trial and error to figure out this was caused by cpuspeed. Misleadingly, the hang doesn't occur immediately after "Starting cpuspeed: [OK]" prints. Instead it occurs when trying to bring up a network interface, which is almost right after cpuspeed starting. With the original 2.6.9-34.ELsmp, it's at "Bringing up interface eth0". With the 2.6.9-34.0.2.ELsmp (and all other rpms updated), it hangs at "Bringing up loopback interface". This may just be a timing thing. We can just forget about cpuspeed, but if any of you have any advice, we'd appreciate it. Otherwise I am basically posting this to save diagnostic time for those who encounter these symptoms in the future. These are dual-core dual Opteron 265/270 servers with Tyan K8SD Pro motherboards. Thanks, Dan

2 1

RE: [CentOS] yum updates
by Bowie Bailey 12 Aug '06

12 Aug '06

Johnny Hughes wrote: > On Tue, 2006-08-08 at 13:08 -0400, Bowie Bailey wrote: > > Johnny Hughes wrote: > > > > > > (or you can remove the package with rpm -e kernel-smp-devel ... then > > > > > > yum install kernel-smp-devel-2.6.9-34.0.1.EL.i686 > > > > > > or > > > > > > yum install kernel-smp-devel-2.6.9-34.0.1.EL.x86_64 ) > > > > I found the updates repo shortly after sending the first email. I > > followed your second suggestion and was able to have "yum install" see > > it after removing the old package. > > > > Why is the "rpm -e" required? It seems like I should be able to do > > "yum update" and specify the package version as long as it is newer > > than what is currently installed. > > > > Yum has no option to install an older file on top of a newer file > > An update probably installed the 34.0.2.EL-xxxx-devel file ... so 34.0.1 > will never install instead of the newer one. The installed package was older. I have already removed the package on the system I was working with, but here is an example from another one that is identical except for being x86_64 instead of i686. # yum info installed kernel-smp-devel Installed Packages Name : kernel-smp-devel Arch : x86_64 Version: 2.6.9 Release: 34.EL Size : 11 M Repo : installed # yum update kernel-smp-devel-2.6.9-34.0.1.EL Setting up Update Process Setting up repositories Reading repository metadata in from local files Could not find update match for kernel-smp-devel-2.6.9-34.0.1.EL No Packages marked for Update/Obsoletion I have verified that the package does exist in the repo: kernel-smp-devel-2.6.9-34.0.1.EL.x86_64.rpm It looks like a "yum update" will only update to the newest package version. -- Bowie

2 1

yum not showing mirror with php/mysql
by Melinda Odom 11 Aug '06

11 Aug '06

Hi, I have had a new server installed using CentOS 4.3 and no matter what settings I try in the /etc/yum.repos.d/CentOS-Base.repo file I cannot get the CentOS mysql and php which are clearly listed in this mirror to even show up: http://mirror.centos.org/centos/4/os/i386/headers/ and only get this: Setting up repositories Reading repository metadata in from local files This is the CentOS-Base.repo listing: [base] #name=CentOS-$releasever - Base name=CentOS-4 - Base #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch &repo=os #baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/ baseurl=http://mirror.centos.org/centos/4/os/i386/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 I have tried this with the same results: [base] name=CentOS-$releasever - Base #name=CentOS-4 - Base mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch& repo=os #baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/ #baseurl=http://mirror.centos.org/centos/4/os/i386/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 I have also tried both listings with the gpgcheck=1 and gpgkey=etc.. commented out # with no success. I appreciate any help with this. Sincerely, Melinda Odom Design Hosting, Inc. www.designhosting.biz 479-471-0891 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.10.9/416 - Release Date: 8/10/2006

3 2

Server Hacked: Cpanel
by Timothy J Rice 11 Aug '06

11 Aug '06

cPanel or ANY server solution should never be deployed until it is locked down! We have been using cPanel for years as well as Hsphere and Plesk for both linux and windows. They all are hackable if not locked down and hardened. We use Trustix, RHEL & CentOs for our Linux environments. The more you allow (in cPanel or any control panel), the less secure. Fix the tmp directory BEFORE you plug it in to the network. File there should NOT be executed by ANYONE. About 3 and a half years ago, we learned this the hard way and every index.* file on a particular server that had cpanel installed was defaced (RH 7 I believe). This was NOT a cPanel issue. It was a combination of a PHP exploit, tmp not being secured, and my lack of knowledge. cPanel has a utility to secure the tmp directory. On a machine that has cPanel installed type the below command: /scripts/securetmp I have never had a problem with this sort of attack after I secured the tmp directory. I also recommend not giving shell access by default. Only give it out to people who need it. Make it a little difficult for the end user. Ask them them to fax a copy of their DL and/or copy of the first page of a utility bill. Sure a bad person can create these documents, but it typically is not worth their time. Also if a user needs ssh bad enough, they will send this info in and they probability will be good users. It also lets them know that you are "security conscious". You can also install a keystroke auditing system such as eas / easd so you can review ssh sessions should you suspect something. If you grant a user ssh rights, reset the end users password to a secure password and let them know that they should maintain a strong password. If their account is bruteforced due to a weak password, cancel their account, as they are too much of a risk for you (or ask them to go dedicated). Install some type of BFD (Brute Force Detection) software. I like http://www.rfxnetworks.com/bfd.php (free and easy to install) Disable things like gcc, wget, lynx . . .etc. I also like to chattr +i files. A very good application is another product from rfnetworks called LES http://www.rfxnetworks.com/les.php Disable root direct login via ssh. Block all incoming traffic except needed ports in iptables (22, 80, 443, 21, . . . ). I like to block all outgoing traffic to all users except for root with the exception of common API's such as Domain registration, Credit Card Gateway etc.) Enable suexec and php safemode if possible. Also disable the mod_dl and other php modules known to have caused problems. If you have users who need every module known to man, setup a server with the php modules needed and only place these users on these systems who specifically need them. Why introduce more risk to users who do NOT need all these features? Install mod_evasive to help against Ddos as well as Mod Security. Run updated rootkit checkers (rkhunter & chkrootkit) daily. This is not perfect, but it will help determine a systems integrity. If a machine has been hacked or owned - you MUST setup a new machine and restore the non binary files to the new machine. This is the sad truth, but you never know what is hiding on a machine after its hacked (owned). Do NOT allow cPanel to automatically update your software or you are asking for problems. Have a cheap server or virtual server with cpanel running on it and update that "test" machine and make sure that nothing breaks. We have 50 beta users who we give hosting to. We place on these users on beta (test) machines. The beta users are aware that these machines are at greater risk than the production machines and they are 100% responsible for backups. It is worth giving away 50 free accounts and place them on test beta platforms so that we can actually simulate a "real" environment while testing cpanel upgrades. If testing is successful, then roll out in production. cPanel has broke many things in the past that were easily fixed by their support staff but why take chances??? I recommend the above measures for any system (cPanel installed or not). cPanel is the most popular control panel for Linux. It allows the end user to control their site and cpanel ties into many billing systems so account provisioning can be automatic. We use it because it offers features that end users demand. Without it, we can't compete . . . so we have to adapt by securing the system as much as possible. Tim Rice Host It Now Networks http://hostitnow.com/ Timothy Rice Host It Now Networks http://hostitnow.com

1 0

Server Hacked: Cpanel
by Karl Balsmeier 11 Aug '06

11 Aug '06

Hi, I have servers of mixed OS, some Centos, some Fedora, and after the flame war that erupted last week (where I said basically nothing and just watched), my server was hacked by this team of hackers, actually their friend: http://www.sibersavascilar.com/ This made Karanbir's statements about mixing Cpanel and Centos (any maybe any linux distro) come true very quickly. If one of the top package maintainers says this, it bears weight. I'd like to know more about this subject, specifically on the package front, for security's sake. Karanbir, can you restate the issues with Cpanel please? They are trying to recommend CentOS as the OS to install on, and even that Linux Journal article did -and before anyone else wastes their time, -let's get everything out in the open so that there's a pipermail archive trail for future folks 'googling' for info later on pros/cons of using, or avoiding use of, non-complimentary projects/technologies. Is the issue that both parties maintain separate packaging/updating regimes and have little or no successful communication as far as keeping thing secure and up to date? That seemed to be what you said, -and if I had the old email, i'd just run with it's advice. Also, can you list the IRC channels you mentioned last time that contain the various hackers bragging about freshly broken Cpanel/Centos builds? Freenode right? Any others? I've been on IRC back when BITNET was still active and there wasn't even mosaic yet, but have always avoided it after 1992 because of hackers 'sniffing for future targets'. William, Jim, Johnny, -any comments are truly welcome, -anyone really. Basically i'd like to help stop or curtail the 'open season' this set of circumstances is creating for hackers, -I have already decided to avoid Cpanel on Centos as it is, -my server that was hacked with Cpanel was not a Centos box, and those that have it, have been shut down. The server next to it was *also* hacked, and that *was* a centos machine, with only a yum update from 3 days prior. Is it really recommeded that I run yum update evry night then? It was stunning to have a box up for 3 days and then get owned so fast. Luckily this was for my personal business entity, and not my full-time job, which indeed does run 50-70 Centos servers behind layers of firewalls and other protections, and *no* commercial products, only centos packages by Dag or Karanbir. To anyone in the mood for scolding, please hold off OK? I'm not in the mood for overbearing attitudes right now. I'm trying to run a business and seek solid answers. I see Centos as a reliable alternative to commercial offerings *if* you pay careful attention to what the senior staff and relevant discussion groups advise. As for the team of hackers, if anyone knows who this is, or can point out who they might be or how to ban them, -that is also most welcome. Hacked By Crackers_Child For Peace DONT WAR ! Greetz : X_Alperen_X, XTech Inc , Metlak, Root_Mor,Dr Hacker, Dr.Jr7 ,Dr,Dermann,Code_Power,CukurOvalý ALL My Friends And All SiberSavascilar.Com Members ! --------------------------------- Stay in the know. Pulse on the new Yahoo.com. Check it out.

9 23

Lang packs (extensions) not found with firefox-1.5.0.5-0.el4.1.centos4 ?
by Vincent Knecht 11 Aug '06

11 Aug '06

Hello, with CentOS 4.3 (i386), after updating firefox to 1.5 from update repo, I can't get it to have menu in my native language (french), altough french language pack appears in extension list. I've tried many things, like moving it on top/down, disabling/removing other languages packs, creating a fresh new user, and reinstalling firefox, to no avail (yes, I restarted firefox between these attempts). I also searched in upstream's bugzilla, and didn't find any issue for v4 & firefox... Finally, launching firefox through strace, I find that it searches for /usr/lib/firefox-1.5.0.5/chrome/fr-FR.jar and can't find it, since french lang pack seems to be /usr/lib/firefox-1.5.0.5/extensions/langpack-fr(a)firefox.mozilla.org/chrome/fr.jar I filed the issue in CentOS bugtracker: http://bugs.centos.org/view.php?id=1442 PS: if that matters, I'm using KDE from kde-redhat repo...

1 0

Multi-Card reader (SD, MMC, etc) and CONFIG_SCSI_MULTI_LUN kernel option in 34.0.2. Workaround
by J.J. Garcia 11 Aug '06

11 Aug '06

Hi folks, Im trying to get a multi-card reader on centos (SD, MMC, and so, 4 card slots) and i have read (http://www.cs.sfu.ca/~ggbaker/personal/cf-linux) that CONFIG_SCSI_MULTI_LUN should be enabled on kernel (=Y) but current 34.0.2 doesn't have it enabled by default, is there any particular reason to not be enabled? By the other hand i've also tweak the /etc/grub.conf file to boot the kernel with max_luns=32 and results are the same, only scsc lun=0 is recognized. At the same time using the workaround mentioned in the link pasted b4 regarding to modify the /etc/modules.conf to include 'options scsi_mod max_scsi_luns=8' gives the same results, no detection at all for the card slots. [root@sparkbox ~]# cat /proc/bus/usb/devices T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0644 ProdID=0200 Rev= 4.00 S: Manufacturer=TEAC S: Product=CA-200 S: SerialNumber=0000020307B2 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb- storage E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms and /var/log/dmesg still shows: <...> scsi3 : SCSI emulation for USB Mass Storage devices Vendor: TEAC Model: USB HS-CF Card Rev: 4.00 Type: Direct-Access ANSI SCSI revision: 02 Attached scsi removable disk sdc at scsi3, channel 0, id 0, lun 0 USB Mass Storage device found at 7 <...> Instead of (if i understand well for this scsi3 line) after a [root@sparkbox]# sg_scan -i (it should show) /dev/sg2: scsi3 channel=0 id=0 lun=0 [em] type=0 Generic STORAGE DEVICE 0128 [wide=0 sync=0 cmdq=0 sftre=0 pq=0x0] /dev/sg3: scsi3 channel=0 id=0 lun=1 [em] type=0 Generic STORAGE DEVICE 0128 [wide=0 sync=0 cmdq=0 sftre=0 pq=0x0] /dev/sg4: scsi3 channel=0 id=0 lun=2 [em] type=0 Generic STORAGE DEVICE 0128 [wide=0 sync=0 cmdq=0 sftre=0 pq=0x0] /dev/sg5: scsi3 channel=0 id=0 lun=3 [em] type=0 Generic STORAGE DEVICE 0128 [wide=0 sync=0 cmdq=0 sftre=0 pq=0x0] But actually, [root@sparkbox ~]# sg_scan -i [root@sparkbox ~]# (shows nothing) And [root@sparkbox ~]# sg_map Stopping because no sg devices found Strange, could not find device /dev/sda mapped to sg device?? Strange, could not find device /dev/sdb mapped to sg device?? Strange, could not find device /dev/sdc mapped to sg device?? Strange, could not find device /dev/sdd mapped to sg device?? Looking at SCSI: [root@sparkbox ~]# cat /proc/scsi/scsi Attached devices: Host: scsi0 Channel: 00 Id: 00 Lun: 00 Vendor: ATA Model: HDS728080PLA380 Rev: PF2O Type: Direct-Access ANSI SCSI revision: 05 Host: scsi2 Channel: 00 Id: 00 Lun: 00 Vendor: Genesys Model: USB to IDE Disk Rev: 0002 Type: Direct-Access ANSI SCSI revision: 02 Host: scsi3 Channel: 00 Id: 00 Lun: 00 Vendor: TEAC Model: USB HS-CF Card Rev: 4.00 Type: Direct-Access ANSI SCSI revision: 02 Host: scsi4 Channel: 00 Id: 00 Lun: 00 Vendor: Model: USB DISK Pro Rev: 1.1b Type: Direct-Access ANSI SCSI revision: 02 And finally doing the last workaround found in the link from Greg Baker article for my scsi3 chain: [root@sparkbox ~]#echo >/proc/scsi/scsi "scsi add-single-device 3 0 0 1" [root@sparkbox ~]#echo >/proc/scsi/scsi "scsi add-single-device 3 0 0 2" [root@sparkbox ~]#echo >/proc/scsi/scsi "scsi add-single-device 3 0 0 3" Solves the identification: [root@sparkbox ~]# cat /proc/scsi/scsi Attached devices: <...> Host: scsi3 Channel: 00 Id: 00 Lun: 00 Vendor: TEAC Model: USB HS-CF Card Rev: 4.00 Type: Direct-Access ANSI SCSI revision: 02 Host: scsi3 Channel: 00 Id: 00 Lun: 01 Vendor: TEAC Model: USB HS-xD/SM Rev: 4.00 Type: Direct-Access ANSI SCSI revision: 02 Host: scsi3 Channel: 00 Id: 00 Lun: 02 Vendor: TEAC Model: USB HS-MS Card Rev: 4.00 Type: Direct-Access ANSI SCSI revision: 02 Host: scsi3 Channel: 00 Id: 00 Lun: 03 Vendor: TEAC Model: USB HS-SD Card Rev: 4.00 Type: Direct-Access ANSI SCSI revision: 02 Now, even without update the udev rules with a new rule It seems to work after inserting the SD (1GB card) card on card-reader, from dmesg: <...> SCSI device sdg: 2012160 512-byte hdwr sectors (1030 MB) sdg: Write Protect is off sdg: Mode Sense: 23 00 00 00 sdg: assuming drive cache: write through SCSI device sdg: 2012160 512-byte hdwr sectors (1030 MB) sdg: Write Protect is off sdg: Mode Sense: 23 00 00 00 sdg: assuming drive cache: write through sdg: sdg1 <...> Mounting the correct SD card on fstab and only remaining to update permissions/udev or pamconsole (not sure where) to get RW access for user space. Hope it helps and just to clarify for mentionned CONFIG_SCSI_MULTI_LUN option in kernel. Jose.

3 7

CentOS-announce Digest, Vol 18, Issue 10
by centos-announce-request＠centos.org 11 Aug '06

11 Aug '06

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2006:0612 Important CentOS 4 i386 krb5 - security update (Johnny Hughes) 2. CESA-2006:0612 Important CentOS 4 x86_64 krb5 - security update (Johnny Hughes) 3. CESA-2006:0619 Moderate CentOS 3 i386 httpd - security update (Tru Huynh) 4. CESA-2006:0619 Moderate CentOS 3 x86_64 httpd - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Thu, 10 Aug 2006 12:30:52 -0500 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2006:0612 Important CentOS 4 i386 krb5 - security update To: CentOS-Announce <centos-announce(a)centos.org> Message-ID: <1155231052.3805.77.camel(a)myth.home.local> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2006:0612 https://rhn.redhat.com/errata/RHSA-2006-0612.html The following updated files have been uploaded and are currently syncing to the mirrors: i386: krb5-devel-1.3.4-33.i386.rpm krb5-libs-1.3.4-33.i386.rpm krb5-server-1.3.4-33.i386.rpm krb5-workstation-1.3.4-33.i386.rpm src: krb5-1.3.4-33.src.rpm

1 0

RE: [CentOS] OT: Measure 2U Server Amp Usage
by Mark Schoonover 10 Aug '06

10 Aug '06

Robert Moskowitz wrote: > Karl R. Balsmeier wrote: >> Hi, >> >> Running a bunch of CentOS servers on 2U supermicro equipment, >> usually with 8 drives on Adaptec SmartRAID V or LSI Megaraid. >> >> In designing a rack in a data center, the question arises as to how >> to measure the amperage the server uses, prior to investing in power >> drops that actually do that for you, even remotely, for about >> $260.00-300USD per unit. This number is the important one these >> days in determining rack/datacenter design. >> > I use the Radio Shack Amp meter. It has an inductance jaw that you > put over ONE wire to the device. This means you need a place on the > circuit that separates the hot and neutral wires. I have a special > rig: Mail plug - separate wires - Female receptacle. Of course I > have to unplug the device, put this rig in, test, then put things > back. > That's one way to measure the current, then multiply by the input voltage to get watts. I think a better way is to determine the max current that the system will use. If you have a 500 watt PSU, assume 85% efficiency, then by using the input voltage you can calculate the max input power the server is going to draw. I'd design the datacenter to support the max power level the server will need, not just what it takes to run the thing. Start up will draw the most power, approaching the max power output of the PSU, then it'll lower some once all the drives are up and spinning. It's somewhat an art, but you can get reasonably close to the entire power draw of your rack. In a pinch, I've added up all the UPSes and told the electrician 12000VA. They'll know what to do with that number. HTH Mark

5 5

← Newer
1
...
19
20
21
22
23
24
25
...
34
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2006